Cybersecurity Compliance and Incident Reporting

The subcontract requires strict adherence to NIST SP 800-171 standards to safeguard Controlled Unclassified Information within all subcontractor systems, ensuring robust cybersecurity controls are implemented and maintained. Compliance is mandatory and must be continuously upheld throughout the performance of the contract, with no exceptions or deviations permitted. Any cyber incident affecting the confidentiality, integrity, or availability of Controlled Unclassified Information must be reported to the appropriate authorities within 72 hours of discovery, with full details provided promptly to enable timely response and mitigation. Failure to meet these requirements may result in contract termination, financial penalties, or loss of future bidding eligibility. The work is performed under the Defense Logistics Agency, a component of the Department of Defense, and falls under the NAICS code 541512 for computer systems design services, indicating the nature of the technical support and IT services expected.